Arun Sood

Accepted papers for the Symposium on Usable Security and Privacy (USEC 2026) are now available: https://lnkd.in/gTzcPvf2 📈 Submissions up 65% 🎯 Acceptance rate 33% Encouraging signs for the continued growth and impact of usable security and privacy research.

39

The DVMS Institute has partnered with Navvia to deliver next-gen cyber governance, resilience, and training via Navvia’s NIST CSF assessment and process modeling platform. We are thrilled to partner with Navvia to bring a truly operationalized approach to digital value governance and cyber resilience. The combination of DVMS Institute’s cyber resilience overlay system and Navvia’s powerful NIST-CSF assessment and process design and management platform provides organizations with a comprehensive solution for aligning governance, risk, and performance assurance with their digital risk and value management strategy.” David Mainville, CEO of Navvia, shared similar enthusiasm: “Our mission has always been to simplify and accelerate an organizational ability to assess and document its governance, compliance, and service improvement initiatives. With the introduction of our new Cybersecurity Framework assessment tool - combining NIST CSF with ITSM Processes, and our partnership with the DVMS Institute, we offer clients a best-in-class solution to assess, build, measure, and sustain cyber resilience and governance excellence. We are helping organizations turn cybersecurity from a reactive technical problem into a strategic business advantage.” For more information about Navvia’s NIST CSF assessment solution and the DVMS Institute’s digital value management frameworks, visit www.navvia.com and www.dvmsinstitute.com . https://lnkd.in/gKKQMBju

13

2 Comments

Breaking Updates from the August CyberAB Town Hall Colleagues, this month’s CyberAB Town Hall delivered significant updates that will shape the path ahead for CMMC adoption across the Defense Industrial Base. A few highlights stood out: 🔹 Rulemaking Progress: The long-awaited Title 48 rule is under OMB review. While October 1, 2025 has circulated as a possible “go-live” date, DoD clarified that this was a holdover from CMMC 1.0 rulemaking. The official date is still pending, but all indications point to implementation before year’s end. 🔹 Certification Growth: To date, 270 Level 2 certifications have been issued. Nine conditional certifications are in place, and 91 assessments remain in progress. The ecosystem continues to grow: 79 Authorized C3PAOs (with #80 on the horizon) 500+ Certified Assessors (CCA) 351 RPOs supporting organizations with readiness 🔹 False Claims Act Reminder: DOJ announced a $1.75M settlement with AeroTurbine, underscoring the risks of non-compliance with NIST 800-171. The message was clear: self-attestation without implementation is a liability. 🔹 Tier 3 Vetting Changes: All personnel associated with the CMMC ecosystem will now be enrolled in continuous vetting under Trusted Workforce 2.0. Clearance verification letters are no longer accepted—packages must include OF306, Tier 3 nomination, and a resume. 🔹 C3PAO Advisory Council: A new 11-member body was introduced to strengthen assessor consistency, reduce costs for SMBs, and provide authoritative feedback on assessment guidance. 🔹 Events & Engagements: CS5 (October, National Harbor) will feature new contractor roundtables and vertical breakouts for architecture, construction, aerospace, and defense. Notably, Katie Arrington and Stacey Bostjanik are confirmed keynote speakers. Q&A Spotlight The Town Hall wrapped with a robust Q&A session. A few themes worth noting: MSP Certifications: An MSP holding a CMMC Level 2 certification can present this as part of a client’s body of evidence during their own assessment. Beyond DoD: Questions surfaced on whether non-DoD agencies will require CMMC. While no official mandates yet, the proposed FAR CUI rule suggests NIST 800-171 may become the unifying baseline across federal agencies. Guidance Consistency: The new C3PAO Advisory Council will review ambiguous scenarios (e.g., stalled assessments, shared responsibility matrices) and provide recommended guidance to improve consistency in application. Transparency in Vetting: For those in Tier 3 adjudication, timelines remain ~6 months on average, but continuous vetting enrollment will now be mandatory moving forward. ✅ Takeaway: The CMMC program is moving from “anticipated” to “operational.” Ecosystem numbers are climbing, rulemaking is on track, and oversight is tightening. Contractors—large and small—must be ready to demonstrate real compliance, not just paper compliance.

3

The California Privacy Protection Agency has opened up a new position -- a Research Technologist to help facilitate audits of businesses covered under the CCPA. https://lnkd.in/gsBE-Ses

55

2 Comments

Thank you, Chris Kraft for sharing this! It is a great study for federal IT leaders to review. The CAISI findings highlight something we've been discussing with agencies: the architecture surrounding your AI matters as much as the models themselves. Key takeaways: On security: The 12x difference in agent hijacking susceptibility underscores why agencies need validation and orchestration layers that sit above any individual model. When processing sensitive data for investigations, eDiscovery, or breach response, you can't rely solely on model guardrails. On cost: The 35% cost differential for similar performance shows agencies that architect for model flexibility rather than vendor lock-in can optimize as the landscape evolves. On performance: The 20-80% variance on cyber tasks shows capabilities are moving targets. What works today may not tomorrow. The common thread: data quality and orchestration are your constants. When you curate unstructured data properly and build orchestration layers that let you leverage multiple models with consistent security controls, you're not betting on any single vendor's trajectory. For agencies dealing with sensitive data such as investigative work, compliance, and mission-critical analysis...having a platform that maintains data sovereignty while giving flexibility to bring the right AI capability to each use case isn't just nice to have. This study shows it's foundational. Thanks for sharing - important reading for AI governance in federal environments.

4

𝗧𝗵𝗲 𝗗𝗼𝗗 𝗜𝘀 𝗢𝘃𝗲𝗿𝗵𝗮𝘂𝗹𝗶𝗻𝗴 𝗜𝘁𝘀 𝗥𝗶𝘀𝗸 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 𝗙𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸 Last week's RFI from the US Department of Defense marks the beginning of its "blow up" of its current Risk Management Framework (RMF). 𝗪𝗵𝗮𝘁'𝘀 𝘁𝗵𝗲 𝗶𝘀𝘀𝘂𝗲? The RMF (as it stands) is slow, redundant, and overly compliance-driven. It burdens cyber and acquisition teams with overwhelming amounts of paperwork and static checklists, often producing risk outputs that obscure actual mission readiness. 𝗜𝗻 𝘀𝗵𝗼𝗿𝘁: It's a dated framework built for an obsolete era in which software deployments don't happen weekly and adversaries don't exploit zero-day vulnerabilities at an industrial scale. 𝗪𝗵𝘆 𝗻𝗼𝘄? The operational environment has shifted and is continuing to do so at a dramatic pace. The volume of vulnerabilities is skyrocketing, threat actors are faster and more adaptive and mission systems, especially those built on modern DevSecOps pipelines, require near real-time visibility into cyber risk. 𝗜𝗻 𝘀𝗵𝗼𝗿𝘁: The current RMF isn't keeping up, and the toll that this is taking has become too much for leadership to bear. 𝗪𝗵𝗮𝘁'𝘀 𝘁𝗵𝗲 𝗽𝗹𝗮𝗻? The DoD is exploring a much-needed streamlined approach with fewer control redundancies, greater automation, and continuous security assessments embedded in the software development lifecycle. Rather than certifying systems and solutions at a single point in time, the new approach would rely on control inheritance, platform security baselines, and threat-informed updates. 𝗜𝗻 𝘀𝗵𝗼𝗿𝘁: Adopt an assessment approach that's designed from the beginning to reduce overhead and move faster. 𝗧𝗵𝗲 𝗯𝗲𝗻𝗲𝗳𝗶𝘁𝘀? - More timely insights into rapidly evolving cyber risks - Fewer bottlenecks for innovation and implementation - Better alignment between security assurance and operational needs 𝗧𝗵𝗲 𝘂𝗹𝘁𝗶𝗺𝗮𝘁𝗲 𝗴𝗼𝗮𝗹: Help commanders understand how cyber risks could directly impact mission readiness and operational outcomes. 𝗕𝗿𝗼𝗮𝗱𝗲𝗿 𝘀𝗼𝗰𝗶𝗲𝘁𝗮𝗹 𝗶𝗺𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻𝘀? This shift isn't only about the DoD. It signals a more widespread truth for any organization that needs to manage cyber risk at scale (so, nearly all entities). Nowadays, we need frameworks and assessment processes that can reflect the swiftly evolving cyber risk landscape. Static approaches won't cut it. Stakeholders need real-time visibility and credible, contextualized quantification that helps them make decisions based on impact. That's the future the DoD is trying to build: an environment where cyber risk is continuously assessed and directly tied to business outcomes. 𝘐𝘵'𝘴 𝘵𝘩𝘦 𝘴𝘢𝘮𝘦 𝘧𝘶𝘵𝘶𝘳𝘦 𝘵𝘩𝘢𝘵 𝘮𝘰𝘥𝘦𝘳𝘯, 𝘰𝘯-𝘥𝘦𝘮𝘢𝘯𝘥 𝘤𝘺𝘣𝘦𝘳 𝘳𝘪𝘴𝘬 𝘱𝘭𝘢𝘵𝘧𝘰𝘳𝘮𝘴 𝘢𝘳𝘦 𝘦𝘯𝘢𝘣𝘭𝘪𝘯𝘨. https://lnkd.in/dGCPWgd6 

27

4 Comments

Everybody needs to understand what happened at this meeting. "Key discussion topics included an overview of the NCCoE project as well as an overview of the Secure Software Development Framework (SSDF). This event also featured two panel discussions focused on cybersecurity challenges and recommendations for software producers and consumers, and the use of AI and Zero Trust in DevSecOps. '

11